Description

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-25T22:17:05.700Z",
  "pubdate": "2026-08-25T22:17:05.700Z",
  "executiveSummary": "An incorrect authorization vulnerability exists within the FORM authentication process of Apache Tomcat. This flaw permits an attacker to circumvent configured security constraints that are designed to restrict resource access based on HTTP methods, specifically allowing unauthorized execution of POST requests to resources otherwise restricted to GET requests.\nThe vulnerability affects Apache Tomcat versions 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120. Additionally, legacy versions 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are known to be impacted, though they are end-of-life (EOL).\nThis issue carries significant risk for applications relying on method-specific access control to protect sensitive operations. An attacker can leverage this bypass to perform unauthorized actions by submitting POST requests to endpoints where such methods should be blocked or restricted by security constraints.\nThe exploitation does not necessarily require advanced administrative privileges, as the bypass occurs during the authentication flow, potentially granting attackers access to protected functionality that requires specific method-level authorization.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of security constraints within the Apache Tomcat FORM authentication mechanism. Specifically, the implementation fails to correctly enforce restrictions when a security constraint is applied to an application resource that distinguishes between HTTP methods (e.g., permitting GET but restricting or requiring authorization for POST).\nDuring the FORM authentication lifecycle, the valve responsible for enforcing security constraints fails to properly validate the requested HTTP method against the configured constraints after the authentication process is completed. This creates a state where the authorization check is either bypassed or improperly evaluated, allowing an attacker to upgrade or alter the method context to execute restricted operations.\nThe attack flow initiates when an attacker targets a resource protected by a security constraint that limits access based on method types. By interacting with the FORM authentication flow, the attacker submits a request using a method that would normally be prohibited or constrained. Because the internal authentication state management fails to reconcile the previous security constraint enforcement with the newly authenticated session context, the server incorrectly grants access to the restricted resource via a POST request.\nThis vulnerability is particularly impactful in environments where administrative actions, state changes, or sensitive data updates are performed via POST requests while the application relies on Tomcat's container-managed security constraints to restrict these actions to authorized users. By bypassing these constraints, an attacker can perform actions that the application developer intended to restrict, effectively elevating their functional access without proper authorization tokens or roles.\nAffected versions include Apache Tomcat 11.0.0-M1 to 11.0.24, 10.1.0-M1 to 10.1.57, and 9.0.0.M1 to 9.0.120. EOL versions 8.5.x and 7.0.x are also susceptible. Exploitation is facilitated by the network exposure of the FORM authentication entry point, and the behavior is consistent regardless of the underlying application logic, as the failure occurs at the container level during the transition from unauthenticated to authenticated request processing.\nThe post-exploitation impact allows for unauthorized interactions with secured resources, potentially leading to data manipulation, unauthorized state modification, or bypassing of business logic controls that rely on method-level security."
}